User Guide for the Network Statistics Management System
Welcome to the User Guide for the Network Statistics Management System, a sophisticated tool designed for real-time monitoring and management of network traffic statistics. This guide provides comprehensive information to effectively interact with the system using its extensive features, making it ideal for network administrators and security operations centers.
System Overview #
The Network Statistics Management System offers a robust solution for collecting, analyzing, and reporting network statistics. It interfaces through RESTful APIs and leverages Redis for efficient data storage and retrieval, facilitating seamless interactions with real-time network data.
Key Features #
Statistics Retrieval:
Retrieve real-time statistics related to network traffic, including packets, bytes, alerts, and protocol-specific data.
Usage: Send a GET request to
/stats
to receive comprehensive network statistics in JSON format.
Packet Statistics:
Access detailed statistics on network packets, including total packets and breakdown by protocols (TCP, UDP, ICMP).
Usage: Issue a GET request to
/stats/pkts
to retrieve packet statistics.
Alert Statistics:
Obtain statistics on security alerts generated by the network monitoring system.
Usage: Access through
/stats/alerts
to fetch alert statistics.
Resource Utilization:
Monitor resource utilization such as CPU and memory usage of the network monitoring system.
Usage: Use endpoints
/stats/cpu
,/stats/vm
, and/stats/pm
for CPU, virtual memory, and physical memory statistics respectively.
Historical Data Analysis:
Analyze historical data for trends and patterns with time-labeled data points.
Usage: Navigate to
/stats/histogram
to get historical data in a histogram format.
Suricata Process Check:
Check the operational status of the Suricata network monitoring process.
Usage: Send a GET request to
/check/suricata
to verify if Suricata is running.
Configuration File Last Modified Date:
Determine when the configuration file for the network monitor was last modified.
Usage: Access
/file/date
to retrieve the last modified date of the configuration file.
CORS Support #
All HTTP responses include CORS (Cross-Origin Resource Sharing) headers, enabling integration into diverse client environments across different domains.
Error Handling #
The system is designed to handle errors gracefully, providing meaningful error messages in the HTTP response to aid debugging and integration efforts.
Configuration and Setup #
System configuration is managed through a configuration file (
config++.conf
), which includes settings for Redis connections and other system parameters.
Retrieving and Saving Reports #
The system allows for the retrieval and saving of detailed statistical reports. This can be accessed through specific API endpoints that interface with Redis to store or retrieve serialized JSON data.
Integration Tips #
Ensure that your client application is configured to handle JSON responses effectively, as all data exchanged with the backend is in JSON format.
Utilize the provided CORS headers if the API is consumed from web applications hosted on different domains.
This user guide aims to equip you with the knowledge to utilize the Network Statistics Management System efficiently. Whether for enhancing network performance monitoring, security analysis, or administrative reporting, the system provides a powerful toolkit for detailed network statistics management.
Processed Packets:
Packets: The number of processed data packets.
Bytes: The total number of bytes that have been processed.
Kernel Packets:
Packets: The number of packets processed at the kernel level.
Drops: The number of packets dropped at the kernel level.
Rule Hits / Alerts:
Alerts (current): The number of current rule trigger notifications.
Alerts (total): The total number of rule triggers (all notifications).
Performance:
HTTP flows: The number of HTTP data flows.
TLS flows: The number of TLS data flows.
Protocols:
TCP: The number of processed TCP packets.
UDP: The number of processed UDP packets.
ICMP: The number of processed ICMP packets.
ICMP6: The number of processed ICMPv6 packets.
HTTP & TLS Statistics:
HTTP sessions: The number of HTTP sessions.
TLS sessions: The number of TLS sessions.
DNS & DHCP Statistics:
DNS Queries: The number of DNS queries.
DNS Answers: The number of DNS answers.
DHCP acks: The number of DHCP acknowledgments.
DHCP discovers: The number of DHCP discovery requests.
DHCP requests: The number of DHCP requests.
DHCP offers: The number of DHCP offers.
Resources:
Uptime: The system uptime since the last start.
Memusage virt.: The usage of virtual memory.
Memusage res.: The usage of resident memory.
Charts:
packetsChart: A chart showing the distribution of processed packets over time.
alertsTimeChart: A chart showing the distribution of rule triggers over time.
This tab allows system administrators to monitor and analyze various aspects of the IDS/IPS Suricata system’s performance, including packet processing, security rule triggers, and system resource usage. The charts and statistical data provide a visual representation of system activity and efficiency, enabling quick identification of potential issues and optimization of the data processing workflow.
More details about suricata settings.